Hi everyone, has anyone here used Kong api gateway to secure their internal API across the organisation?

I haven't used it, but I am curious to hear where you're about to go next with your questioning!

As a first step I want to understand how can we make use of it for API discoverability

Oh, interesting. Can you say more about that? What are some problems you need to solve for in the discovery space?

We have multiple teams in our organisation, sometimes it becomes difficult to get the API details available for reuse . So we are planning to list down all the API with its specifications and owner of that API in one place. So looking for the solution to know is there a way in Kong to import all the APIs from version control maybe

If I can restate then to check my understanding: 1. Catalog: Your organization's API program is less organized than it could/should be. You don't have a central catalog for API assets, meaning people have to look in many places to find out whether there is an existing solution they could use. Potential efficiency gains require some cross-team coordination that might look a bit like a platform engineering problem. 2. One potential source of API information to populate that could come from the preferred internal gateway solution (Kong, likely others if the org is big enough). Another might be from crawling through source control to discover API specs. Good so far?

Yes right

This space has some similarities to a service catalog. Do you have something like that in place? IMO, this is a platform problem adjacent to the app delivery space.

We don’t have it right now , trying to build one

Have used Emissary Ingress to do something very similar at a previous role (can't find any more recent mentions of the feature, so not sure how well it survived in later versions) https://www.getambassador.io/docs/emissary/latest/tutorials/dev-portal-tutorial

You’re probably looking for this feature @Monika J: https://konghq.com/products/kong-konnect/features/developer-portal I haven’t used it, but probably @Daniel Kocot can lend some experience?

The API portal space was heavily influenced by externalized API products. To support the API development lifecycle, consider carefully what kinds of features you might need (those aren't generally the same as for an external portal). How will you surface pre-production environments? Do you intend to apply governance processes during development? Etc. Most importantly, are you willing to exclude APIs that use a different gateway?